@passflow/react 0.6.0 → 0.7.0

package/dist/index.es.js

@@ -5,8 +5,8 @@ import 'dayjs';
 import clsx from 'clsx';
 import { twMerge } from 'tailwind-merge';
 import * as React from 'react';
-import { useState, useEffect, forwardRef, createContext, useCallback, useContext, useRef, useLayoutEffect, useMemo, useReducer } from 'react';
-import { PassflowEvent, parseToken, Passflow } from '@passflow/core';
+import React__default, { useState, useEffect, forwardRef, createContext, useCallback, useContext, useRef, useLayoutEffect, useMemo, useReducer } from 'react';
+import { PassflowEvent, Passflow, parseToken } from '@passflow/core';
 export * from '@passflow/core';
 import queryString from 'query-string';
 import { getCountryForTimezone } from 'countries-and-timezones';
@@ -20,7 +20,7 @@ import { phone as phone$1 } from 'phone';
 import { useForm, Controller } from 'react-hook-form';
 import 'react-dom';
 
-const version = "0.6.0";
+const version = "0.7.0";
 
 window.passflowReactAppVersion = () => {
   console.log(`App Version: ${version}`);
@@ -3111,6 +3111,323 @@ const ErrorComponent = ({ error = defaultErrorMessage, goBackRedirectTo }) => {
   );
 };
 
+const AUTH_ENDPOINT_PATTERN = /\/auth\/(login|passwordless|passkey|2fa|session\/exchange)\b|\/auth\/federated\/start\b/;
+const readParentChallengeIdFromURL = () => {
+  if (typeof window === "undefined") return void 0;
+  const raw = new URLSearchParams(window.location.search);
+  const lower = new URLSearchParams(Array.from(raw, ([key, value2]) => [key.toLowerCase(), value2]));
+  const value = lower.get("parent_challenge_id");
+  return value || void 0;
+};
+const bootParentChallengeId = readParentChallengeIdFromURL();
+const useOIDCInterceptor = (parentChallengeId) => {
+  useEffect(() => {
+    if (!parentChallengeId || typeof window === "undefined") {
+      return;
+    }
+    const isAuthURL = (url) => AUTH_ENDPOINT_PATTERN.test(url);
+    const injectParentChallenge = (raw) => {
+      if (!raw) return void 0;
+      try {
+        const obj = JSON.parse(raw);
+        if ("parent_challenge_id" in obj) return void 0;
+        obj.parent_challenge_id = parentChallengeId;
+        return JSON.stringify(obj);
+      } catch {
+        return void 0;
+      }
+    };
+    const followRedirectURL = (raw) => {
+      if (!raw) return;
+      try {
+        const obj = JSON.parse(raw);
+        if (typeof obj.redirect_url === "string" && obj.redirect_url) {
+          window.location.assign(obj.redirect_url);
+        }
+      } catch {
+      }
+    };
+    const originalFetch = window.fetch;
+    window.fetch = async (input, init) => {
+      let url = "";
+      if (typeof input === "string") url = input;
+      else if (input instanceof URL) url = input.toString();
+      else if (input instanceof Request) url = input.url;
+      const method = init?.method?.toUpperCase() ?? "GET";
+      let outInit = init;
+      if (method === "POST" && isAuthURL(url) && typeof init?.body === "string") {
+        const rewritten = injectParentChallenge(init.body);
+        if (rewritten !== void 0) outInit = { ...init, body: rewritten };
+      }
+      const response = await originalFetch(input, outInit);
+      if (response.ok && isAuthURL(url)) {
+        try {
+          const cloned = response.clone();
+          const text = await cloned.text();
+          followRedirectURL(text);
+        } catch {
+        }
+      }
+      return response;
+    };
+    const OriginalXHROpen = XMLHttpRequest.prototype.open;
+    const OriginalXHRSend = XMLHttpRequest.prototype.send;
+    const tracker = /* @__PURE__ */ new WeakMap();
+    XMLHttpRequest.prototype.open = function(method, url, ...rest) {
+      const urlStr = typeof url === "string" ? url : url.toString();
+      tracker.set(this, {
+        method: method?.toUpperCase(),
+        url: urlStr,
+        isAuth: isAuthURL(urlStr)
+      });
+      this.addEventListener("load", () => {
+        const meta = tracker.get(this);
+        if (!meta?.isAuth) return;
+        if (this.status >= 200 && this.status < 300) {
+          followRedirectURL(typeof this.responseText === "string" ? this.responseText : null);
+        }
+      });
+      OriginalXHROpen.call(this, method, url, ...rest);
+    };
+    XMLHttpRequest.prototype.send = function(body) {
+      const meta = tracker.get(this);
+      let outBody = body;
+      if (meta?.isAuth && meta.method === "POST" && typeof body === "string") {
+        const rewritten = injectParentChallenge(body);
+        if (rewritten !== void 0) outBody = rewritten;
+      }
+      OriginalXHRSend.call(this, outBody);
+    };
+    return () => {
+      window.fetch = originalFetch;
+      XMLHttpRequest.prototype.open = OriginalXHROpen;
+      XMLHttpRequest.prototype.send = OriginalXHRSend;
+    };
+  }, [parentChallengeId]);
+};
+const useSessionExchangeOnMount = (parentChallengeId, passflow, baseUrl, appId) => {
+  const [exchangeState, setExchangeState] = useState("idle");
+  const [parentMeta, setParentMeta] = useState(void 0);
+  const attemptedRef = useRef(false);
+  useEffect(() => {
+    if (!parentChallengeId || attemptedRef.current) {
+      return;
+    }
+    if (!appId) {
+      return;
+    }
+    attemptedRef.current = true;
+    const run = async () => {
+      let meta;
+      try {
+        const base = baseUrl ?? "";
+        const url = `${base}/oidc/requests/${encodeURIComponent(parentChallengeId)}`;
+        const res = await fetch(url);
+        if (res.ok) {
+          meta = await res.json();
+          setParentMeta(meta);
+        }
+      } catch {
+      }
+      if (meta?.oidc_prompt_login) {
+        setExchangeState("fallback_to_login");
+        return;
+      }
+      if (meta?.max_age && meta.max_age > 0) {
+        const parsed = passflow.getParsedTokens?.();
+        const accessPayload = parsed?.access_token?.payload;
+        const idPayload = parsed?.id_token?.payload;
+        const authTime = accessPayload?.auth_time ?? idPayload?.auth_time;
+        if (authTime && typeof authTime === "number") {
+          const ageSeconds = Math.floor(Date.now() / 1e3) - authTime;
+          if (ageSeconds > meta.max_age) {
+            setExchangeState("fallback_to_login");
+            return;
+          }
+        }
+      }
+      setExchangeState("exchanging");
+      try {
+        let accessToken;
+        try {
+          const tokens = await passflow.getTokens(false);
+          accessToken = tokens?.access_token;
+        } catch {
+        }
+        const base = baseUrl ?? "";
+        const headers = {
+          "Content-Type": "application/json"
+        };
+        if (accessToken) {
+          headers.Authorization = `Bearer ${accessToken}`;
+        }
+        if (appId) {
+          headers["X-Passflow-ClientID"] = appId;
+        }
+        const res = await fetch(`${base}/auth/session/exchange`, {
+          method: "POST",
+          credentials: "include",
+          headers,
+          body: JSON.stringify({ parent_challenge_id: parentChallengeId })
+        });
+        if (res.ok) {
+          try {
+            const body = await res.json();
+            if (body.redirect_url) {
+              return;
+            }
+          } catch {
+          }
+          setExchangeState("fallback_to_login");
+          return;
+        }
+        if (res.status === 403) {
+          setExchangeState("fallback_to_login");
+          return;
+        }
+        if (res.status === 401 || res.status === 400) {
+          if (meta?.oidc_prompt_none && meta.redirect_uri) {
+            const dest = new URL(meta.redirect_uri);
+            dest.searchParams.set("error", "login_required");
+            dest.searchParams.set("error_description", "user is not authenticated");
+            if (meta.state) dest.searchParams.set("state", meta.state);
+            window.location.assign(dest.toString());
+            return;
+          }
+          setExchangeState("fallback_to_login");
+          return;
+        }
+        setExchangeState("fallback_to_login");
+      } catch {
+        setExchangeState("fallback_to_login");
+      }
+    };
+    void run();
+  }, [parentChallengeId, passflow, baseUrl, appId]);
+  return { exchangeState, parentMeta };
+};
+const DefaultContinuingPlaceholder = ({ appName }) => /* @__PURE__ */ jsx(
+  "div",
+  {
+    style: {
+      display: "flex",
+      alignItems: "center",
+      justifyContent: "center",
+      minHeight: "100vh",
+      fontFamily: "system-ui, sans-serif",
+      fontSize: "1rem",
+      color: "#444"
+    },
+    children: appName ? `Continuing to ${appName}…` : "Continuing…"
+  }
+);
+const DefaultUpgradeRequiredPlaceholder = () => /* @__PURE__ */ jsx(
+  "div",
+  {
+    style: {
+      display: "flex",
+      alignItems: "center",
+      justifyContent: "center",
+      padding: "1rem",
+      fontFamily: "system-ui, sans-serif",
+      fontSize: "0.95rem",
+      color: "#666"
+    },
+    children: "Additional authentication required (not yet implemented — please log in again)."
+  }
+);
+const OIDCExchangeContext = React__default.createContext({
+  exchangeState: "idle"
+});
+const PassflowProvider = ({
+  children,
+  navigate: initialNavigate,
+  router = "default",
+  ...config
+}) => {
+  const needsDiscovery = !config.appId;
+  const [state, dispatch] = useReducer(passflowReducer, {
+    ...initialState,
+    ...config,
+    isDiscoveringAppId: needsDiscovery
+  });
+  const [navigate, setNavigate] = useState(() => {
+    if (initialNavigate) {
+      return initialNavigate;
+    }
+    return defaultNavigate;
+  });
+  const passflow = useMemo(() => new Passflow(state), [state]);
+  const parentChallengeId = useMemo(() => readParentChallengeIdFromURL() ?? bootParentChallengeId, []);
+  useOIDCInterceptor(parentChallengeId);
+  const { exchangeState, parentMeta } = useSessionExchangeOnMount(parentChallengeId, passflow, config.url, state.appId);
+  const discoveryAttemptedRef = useRef(false);
+  useEffect(() => {
+    if (needsDiscovery && !discoveryAttemptedRef.current && state.isDiscoveringAppId) {
+      discoveryAttemptedRef.current = true;
+      const discoverAppId = async () => {
+        const urlsToTry = ["/settings"];
+        if (config.url) {
+          urlsToTry.push(`${config.url}/settings`);
+        }
+        for (const url of urlsToTry) {
+          try {
+            const response = await fetch(url);
+            if (response.ok) {
+              const settings = await response.json();
+              const discoveredAppId = settings.login_app?.app_id || settings.appId;
+              if (discoveredAppId) {
+                passflow.setAppId(discoveredAppId);
+                dispatch({
+                  type: "SET_PASSFLOW_STATE",
+                  payload: {
+                    ...state,
+                    appId: discoveredAppId,
+                    scopes: settings.login_app?.scopes || settings.scopes || state.scopes,
+                    createTenantForNewUser: settings.login_app?.create_tenant_for_new_user ?? settings.createTenantForNewUser ?? state.createTenantForNewUser,
+                    isDiscoveringAppId: false
+                  }
+                });
+                return;
+              }
+            }
+          } catch (error) {
+          }
+        }
+        console.warn("Failed to discover appId from /settings");
+        dispatch({
+          type: "SET_PASSFLOW_STATE",
+          payload: {
+            ...state,
+            isDiscoveringAppId: false
+          }
+        });
+      };
+      void discoverAppId();
+    }
+  }, [needsDiscovery, state.isDiscoveringAppId, config.url, passflow, state]);
+  const passflowValue = useMemo(() => ({ state, dispatch, passflow }), [state, passflow]);
+  const handleSetNavigate = useCallback((newNavigate) => {
+    setNavigate(() => newNavigate || defaultNavigate);
+  }, []);
+  const navigationValue = useMemo(
+    () => ({
+      navigate,
+      setNavigate: handleSetNavigate,
+      router
+    }),
+    [navigate, handleSetNavigate, router]
+  );
+  const oidcExchangeValue = useMemo(
+    () => ({ parentChallengeId, parentMeta, exchangeState }),
+    [parentChallengeId, parentMeta, exchangeState]
+  );
+  return /* @__PURE__ */ jsx(PassflowContext.Provider, { value: passflowValue, children: /* @__PURE__ */ jsx(NavigationContext$1.Provider, { value: navigationValue, children: /* @__PURE__ */ jsx(OIDCExchangeContext.Provider, { value: oidcExchangeValue, children: /* @__PURE__ */ jsx(AuthProvider, { children: exchangeState === "exchanging" ? /* @__PURE__ */ jsx(DefaultContinuingPlaceholder, { appName: parentMeta?.app_name }) : exchangeState === "upgrade_required" ? /* @__PURE__ */ jsxs(Fragment, { children: [
+    /* @__PURE__ */ jsx(DefaultUpgradeRequiredPlaceholder, {}),
+    children
+  ] }) : children }) }) }) });
+};
+
 const excludeRoutes = ["verify-challenge-otp", "password/reset", "two-factor-verify", "two-factor-recovery"];
 const withError = (Component, ErrorComponent) => (props) => {
   const context = useContext(PassflowContext);
@@ -3223,6 +3540,13 @@ const SignInForm = ({
     setForcePasswordless(checked);
     resetFormStates();
   };
+  const warnIfOIDCFlowLeaked = () => {
+    if (readParentChallengeIdFromURL()) {
+      console.error(
+        "[passflow] login took the legacy token path while parent_challenge_id is present on the URL — the OIDC interceptor did not engage and the RP redirect will not happen"
+      );
+    }
+  };
   const onSubmitPasswordHandler = async (userPayload) => {
     const payload = {
       ...userPayload,
@@ -3234,7 +3558,8 @@ const SignInForm = ({
         navigate({ to: twoFactorVerifyPath ?? routes.two_factor_verify.path });
         return;
       }
-      const redirectUrl = successAuthRedirect ?? appSettings?.defaults.redirect ?? "";
+      warnIfOIDCFlowLeaked();
+      const redirectUrl = successAuthRedirect ?? appSettings?.defaults?.redirect ?? "";
       if (!isValidUrl(redirectUrl)) navigate({ to: redirectUrl });
       else window.location.href = await getUrlWithTokens(passflow, redirectUrl);
     }
@@ -3250,7 +3575,8 @@ const SignInForm = ({
         navigate({ to: twoFactorVerifyPath ?? routes.two_factor_verify.path });
         return;
       }
-      const redirectUrl = successAuthRedirect ?? appSettings?.defaults.redirect ?? "";
+      warnIfOIDCFlowLeaked();
+      const redirectUrl = successAuthRedirect ?? appSettings?.defaults?.redirect ?? "";
       if (!isValidUrl(redirectUrl)) navigate({ to: redirectUrl });
       else window.location.href = await getUrlWithTokens(passflow, redirectUrl);
     }
@@ -3261,7 +3587,7 @@ const SignInForm = ({
       ...userPayload,
       challenge_type: getPasswordlessData(authMethods, defaultMethod)?.challengeType,
       create_tenant: createTenantForNewUser,
-      redirect_url: successAuthRedirect ?? appSettings?.defaults.redirect,
+      redirect_url: successAuthRedirect ?? appSettings?.defaults?.redirect,
       ...!isEmpty(inviteToken) && { invite_token: inviteToken }
     };
     const response = await fetch(payload, "passwordless");
@@ -3692,13 +4018,13 @@ const SignUpForm = ({
     };
     const status = await fetch(payload, "password");
     if (status) {
-      const redirectUrl = successAuthRedirect ?? appSettings?.defaults.redirect ?? "";
+      const redirectUrl = successAuthRedirect ?? appSettings?.defaults?.redirect ?? "";
       if (!isValidUrl(redirectUrl)) navigate({ to: redirectUrl });
       else window.location.href = await getUrlWithTokens(passflow, redirectUrl);
     }
   };
   const onSubmitPasskeyHandler = async () => {
-    const redirectUrl = successAuthRedirect ?? appSettings?.defaults.redirect ?? "";
+    const redirectUrl = successAuthRedirect ?? appSettings?.defaults?.redirect ?? "";
     const payload = {
       relying_party_id: relyingPartyId,
       create_tenant: createTenantForNewUser,
@@ -3718,7 +4044,7 @@ const SignUpForm = ({
       ...userPayload,
       challenge_type: currentChallegeType,
       create_tenant: createTenantForNewUser,
-      redirect_url: successAuthRedirect ?? appSettings?.defaults.redirect,
+      redirect_url: successAuthRedirect ?? appSettings?.defaults?.redirect,
       ...!isEmpty(inviteToken) && { invite_token: inviteToken }
     };
     const response = await fetch(payload, "passwordless");
@@ -4204,7 +4530,7 @@ const VerifyChallengeOTPManual = ({
       const payload = {
         create_tenant: createTenantForNewUser,
         challenge_type: challengeType,
-        redirect_url: successAuthRedirect ?? appSettings?.defaults.redirect ?? "",
+        redirect_url: successAuthRedirect ?? appSettings?.defaults?.redirect ?? "",
         ...identity === "email" ? { email: identityValue } : { phone: identityValue }
       };
       const refetchResponse = await refetch(payload, type);
@@ -4457,7 +4783,7 @@ const ForgotPassword = ({
       ...isEmail && { email: values.email_or_username },
       ...isUsername && { username: values.email_or_username },
       ...isPhone && { phone: validatedPhone.phoneNumber },
-      redirect_url: successResetRedirect ?? appSettings?.defaults.redirect
+      redirect_url: successResetRedirect ?? appSettings?.defaults?.redirect
     };
     const status = await fetch(payload);
     if (status) {
@@ -4675,12 +5001,12 @@ const ResetPassword = ({ successAuthRedirect }) => {
     const resetTokenType = resetTokenData;
     const status = await fetch(values.password);
     if (status) {
-      if (!isValidUrl(resetTokenType?.redirect_url ?? successAuthRedirect ?? appSettings?.defaults.redirect))
-        navigate({ to: resetTokenType?.redirect_url ?? successAuthRedirect ?? appSettings?.defaults.redirect });
+      if (!isValidUrl(resetTokenType?.redirect_url ?? successAuthRedirect ?? appSettings?.defaults?.redirect))
+        navigate({ to: resetTokenType?.redirect_url ?? successAuthRedirect ?? appSettings?.defaults?.redirect });
       else
         window.location.href = await getUrlWithTokens(
           passflow,
-          resetTokenType?.redirect_url ?? successAuthRedirect ?? appSettings?.defaults.redirect
+          resetTokenType?.redirect_url ?? successAuthRedirect ?? appSettings?.defaults?.redirect
         );
     }
   };
@@ -4843,7 +5169,7 @@ const InvitationJoinFlow = ({
               type: "button",
               variant: "primary",
               className: "passflow-button-invitation-join",
-              onClick: () => void onClickAcceptInvitationHandler(redirectUrl ?? successAuthRedirect ?? appSettings?.defaults.redirect),
+              onClick: () => void onClickAcceptInvitationHandler(redirectUrl ?? successAuthRedirect ?? appSettings?.defaults?.redirect),
               disabled: isInvitationJoinLoading,
               children: "Accept invitation"
             }
@@ -6978,84 +7304,5 @@ function formatCountdown(seconds) {
   return `${mins}:${secs.toString().padStart(2, "0")}`;
 }
 
-const PassflowProvider = ({
-  children,
-  navigate: initialNavigate,
-  router = "default",
-  ...config
-}) => {
-  const needsDiscovery = !config.appId;
-  const [state, dispatch] = useReducer(passflowReducer, {
-    ...initialState,
-    ...config,
-    isDiscoveringAppId: needsDiscovery
-  });
-  const [navigate, setNavigate] = useState(() => {
-    if (initialNavigate) {
-      return initialNavigate;
-    }
-    return defaultNavigate;
-  });
-  const passflow = useMemo(() => new Passflow(state), [state]);
-  const discoveryAttemptedRef = useRef(false);
-  useEffect(() => {
-    if (needsDiscovery && !discoveryAttemptedRef.current && state.isDiscoveringAppId) {
-      discoveryAttemptedRef.current = true;
-      const discoverAppId = async () => {
-        const urlsToTry = ["/settings"];
-        if (config.url) {
-          urlsToTry.push(`${config.url}/settings`);
-        }
-        for (const url of urlsToTry) {
-          try {
-            const response = await fetch(url);
-            if (response.ok) {
-              const settings = await response.json();
-              const discoveredAppId = settings.login_app?.app_id || settings.appId;
-              if (discoveredAppId) {
-                passflow.setAppId(discoveredAppId);
-                dispatch({
-                  type: "SET_PASSFLOW_STATE",
-                  payload: {
-                    ...state,
-                    appId: discoveredAppId,
-                    scopes: settings.login_app?.scopes || settings.scopes || state.scopes,
-                    createTenantForNewUser: settings.login_app?.create_tenant_for_new_user ?? settings.createTenantForNewUser ?? state.createTenantForNewUser,
-                    isDiscoveringAppId: false
-                  }
-                });
-                return;
-              }
-            }
-          } catch (error) {
-          }
-        }
-        console.warn("Failed to discover appId from /settings");
-        dispatch({
-          type: "SET_PASSFLOW_STATE",
-          payload: {
-            ...state,
-            isDiscoveringAppId: false
-          }
-        });
-      };
-      void discoverAppId();
-    }
-  }, [needsDiscovery, state.isDiscoveringAppId, config.url, passflow, state]);
-  const passflowValue = useMemo(() => ({ state, dispatch, passflow }), [state, passflow]);
-  const handleSetNavigate = useCallback((newNavigate) => {
-    setNavigate(() => newNavigate || defaultNavigate);
-  }, []);
-  const navigationValue = useMemo(
-    () => ({
-      navigate,
-      setNavigate: handleSetNavigate,
-      router
-    }),
-    [navigate, handleSetNavigate, router]
-  );
-  return /* @__PURE__ */ jsx(PassflowContext.Provider, { value: passflowValue, children: /* @__PURE__ */ jsx(NavigationContext$1.Provider, { value: navigationValue, children: /* @__PURE__ */ jsx(AuthProvider, { children }) }) });
-};
-
 export { Button, CLIBrowserAuth, CLIQRAuth, Dialog, DialogClose, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogOverlay, DialogPortal, DialogTitle, DialogTrigger, FieldPassword, FieldPhone, FieldText, ForgotPassword, ForgotPasswordSuccess, Icon, InvitationJoin, Link, PassflowFlow, PassflowProvider, Popover, PopoverAnchor, PopoverContent, PopoverTrigger, ProvidersBox, ResetPassword, SignIn, SignInForm, SignUp, SignUpForm, Switch, TwoFactorChallenge, TwoFactorRecoveryForm, TwoFactorSetupForm, TwoFactorSetupMagicLinkFlow, TwoFactorVerifyForm, VerifyChallengeMagicLink, VerifyChallengeOTP, Wrapper, useAppSettings, useAuth, useAuthCloudRedirect, useCLIAuth, useForgotPassword, useJoinInvite, useLogout, useNavigation, useOutsideClick, usePassflow, usePasswordlessComplete, useProvider, useResetPassword, useSessionExpired, useSignIn, useSignUp, useTwoFactorChallenge, useTwoFactorManage, useTwoFactorMethods, useTwoFactorSetup, useTwoFactorSetupMagicLink, useTwoFactorStatus, useTwoFactorVerify, useUserPasskeys };
 //# sourceMappingURL=index.es.js.map